PT-2019-11871 · Teclib · Glpi+1

Damien Picard + 1 · Published 2019-03-29 · Updated 2019-04-01 · CVE-2019-10477

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions FusionInventory plugin versions prior to 1.4 for GLPI 9.3.x FusionInventory plugin versions prior to 1.1 for GLPI 9.4.x

Description The issue is related to the mishandling of sendXML actions by the FusionInventory plugin.

Recommendations For FusionInventory plugin versions prior to 1.4 for GLPI 9.3.x, update to version 1.4 or later. For FusionInventory plugin versions prior to 1.1 for GLPI 9.4.x, update to version 1.1 or later.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2019-10477

Affected Products

Fusioninventory Plugin

Glpi

References · 7

• https://github.com/fusioninventory/fusioninventory-for-glpi/compare/260a864...e1f776d · Patch
• https://github.com/fusioninventory/fusioninventory-for-glpi/compare/cec774a...baa4158 · Patch
• https://github.com/fusioninventory/fusioninventory-for-glpi/commit/0f777f85773b18f5252e79afa1929fcdc4858c3a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-10477 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10477 · Vendor Advisory
• https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.3%2B1.4 · Note
• https://github.com/fusioninventory/fusioninventory-for-glpi/releases/tag/glpi9.4%2B1.1 · Note